Updated Grsec/PaX20101012

 2.2.0-2.6.32.24-201010121028 for 2.6.32.24
 2.2.0-2.6.35.7-201010121028 for 2.6.35.7

4 files changed, 48 insertions, 4 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 83010ab..b3827c9 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -3,7 +3,7 @@ README
 
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.2.0-2.6.32.24-201010101609.patch
+Patch:	4420_grsecurity-2.2.0-2.6.32.24-201010121028.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.2.0-2.6.32.24-201010101609.patch b/2.6.32/4420_grsecurity-2.2.0-2.6.32.24-201010121028.patch
index ad7ddad..52451a1 100644
--- a/2.6.32/4420_grsecurity-2.2.0-2.6.32.24-201010101609.patch
+++ b/2.6.32/4420_grsecurity-2.2.0-2.6.32.24-201010121028.patch
@@ -58053,6 +58053,28 @@ diff -urNp linux-2.6.32.24/sound/aoa/codecs/onyx.c linux-2.6.32.24/sound/aoa/cod
  		onyx->spdif_locked = onyx->analog_locked = 0;
  	mutex_unlock(&onyx->mutex);
  
+diff -urNp linux-2.6.32.24/sound/core/control.c linux-2.6.32.24/sound/core/control.c
+--- linux-2.6.32.24/sound/core/control.c	2010-08-13 16:24:37.000000000 -0400
++++ linux-2.6.32.24/sound/core/control.c	2010-10-12 10:26:46.000000000 -0400
+@@ -31,6 +31,7 @@
+ 
+ /* max number of user-defined controls */
+ #define MAX_USER_CONTROLS	32
++#define MAX_CONTROL_COUNT	1028
+ 
+ struct snd_kctl_ioctl {
+ 	struct list_head list;		/* list of all ioctls */
+@@ -190,6 +191,10 @@ static struct snd_kcontrol *snd_ctl_new(
+ 	
+ 	if (snd_BUG_ON(!control || !control->count))
+ 		return NULL;
++
++	if (control->count > MAX_CONTROL_COUNT)
++		return NULL;
++
+ 	kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
+ 	if (kctl == NULL) {
+ 		snd_printk(KERN_ERR "Cannot allocate control instance\n");
 diff -urNp linux-2.6.32.24/sound/core/oss/pcm_oss.c linux-2.6.32.24/sound/core/oss/pcm_oss.c
 --- linux-2.6.32.24/sound/core/oss/pcm_oss.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.24/sound/core/oss/pcm_oss.c	2010-09-04 15:54:52.000000000 -0400
diff --git a/2.6.35/0000_README b/2.6.35/0000_README
index 280891e..4fdcca3 100644
--- a/2.6.35/0000_README
+++ b/2.6.35/0000_README
@@ -3,7 +3,7 @@ README
 
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.2.0-2.6.35.7-201010112244.patch
+Patch:	4420_grsecurity-2.2.0-2.6.35.7-201010121028.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.35/4420_grsecurity-2.2.0-2.6.35.7-201010112244.patch b/2.6.35/4420_grsecurity-2.2.0-2.6.35.7-201010121028.patch
index fbe5a60..f26db46 100644
--- a/2.6.35/4420_grsecurity-2.2.0-2.6.35.7-201010112244.patch
+++ b/2.6.35/4420_grsecurity-2.2.0-2.6.35.7-201010121028.patch
@@ -43737,7 +43737,7 @@ diff -urNp linux-2.6.35.7/include/acpi/acpi_drivers.h linux-2.6.35.7/include/acp
  	return -ENODEV;
 diff -urNp linux-2.6.35.7/include/asm-generic/atomic-long.h linux-2.6.35.7/include/asm-generic/atomic-long.h
 --- linux-2.6.35.7/include/asm-generic/atomic-long.h	2010-08-26 19:47:12.000000000 -0400
-+++ linux-2.6.35.7/include/asm-generic/atomic-long.h	2010-10-11 22:41:44.000000000 -0400
++++ linux-2.6.35.7/include/asm-generic/atomic-long.h	2010-10-12 10:19:29.000000000 -0400
 @@ -22,6 +22,12 @@
  
  typedef atomic64_t atomic_long_t;
@@ -43985,7 +43985,7 @@ diff -urNp linux-2.6.35.7/include/asm-generic/atomic-long.h linux-2.6.35.7/inclu
 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
 +#define atomic_inc_unchecked(v) atomic_inc(v)
 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
-+#define atomic_add_return_unchecked(v) atomic_add_return(v)
++#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
 +
 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
@@ -57033,6 +57033,28 @@ diff -urNp linux-2.6.35.7/sound/aoa/codecs/onyx.c linux-2.6.35.7/sound/aoa/codec
  		onyx->spdif_locked = onyx->analog_locked = 0;
  	mutex_unlock(&onyx->mutex);
  
+diff -urNp linux-2.6.35.7/sound/core/control.c linux-2.6.35.7/sound/core/control.c
+--- linux-2.6.35.7/sound/core/control.c	2010-08-26 19:47:12.000000000 -0400
++++ linux-2.6.35.7/sound/core/control.c	2010-10-12 10:28:04.000000000 -0400
+@@ -31,6 +31,7 @@
+ 
+ /* max number of user-defined controls */
+ #define MAX_USER_CONTROLS	32
++#define MAX_CONTROL_COUNT	1028
+ 
+ struct snd_kctl_ioctl {
+ 	struct list_head list;		/* list of all ioctls */
+@@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new(
+ 	
+ 	if (snd_BUG_ON(!control || !control->count))
+ 		return NULL;
++
++	if (control->count > MAX_CONTROL_COUNT)
++		return NULL;
++
+ 	kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
+ 	if (kctl == NULL) {
+ 		snd_printk(KERN_ERR "Cannot allocate control instance\n");
 diff -urNp linux-2.6.35.7/sound/core/oss/pcm_oss.c linux-2.6.35.7/sound/core/oss/pcm_oss.c
 --- linux-2.6.35.7/sound/core/oss/pcm_oss.c	2010-08-26 19:47:12.000000000 -0400
 +++ linux-2.6.35.7/sound/core/oss/pcm_oss.c	2010-09-17 20:12:09.000000000 -0400